Bitwarden Dev Ops Engineer

Skill 34 of 65

Workflow Fix

Apply fixes for workflow linter findings identified by the workflow-audit skill.

2 minutes · 434 words · 9 sections

Install

$ npx skills add bitwarden/ai-plugins --skill workflow-fix

$ npx skills add bitwarden/ai-plugins

» /plugin marketplace add bitwarden/ai-plugins

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Rules

No mutating API calls without confirmation. gh api GET requests are allowed freely. Any call using -X POST, -X PUT, -X PATCH, or -X DELETE must be shown to the user and approved before execution.
Never force-push, delete branches, or delete repositories.
Only modify files under .github/. Do not touch application code, scripts, or configuration outside of workflow files.
Show a diff and get confirmation before handing off for commit.
All PRs must be created as drafts.
Flag uncertainty. If a finding is ambiguous or a fix could break a workflow, stop and ask rather than guessing.

Step 1: Verify Prerequisites

Check if bwwl is available:

bwwl --version

If the command is not found, stop and inform the user that bwwl must be installed before continuing. Do not attempt to install it.

Step 2: Determine Scope

Parse the user’s request to determine what to fix:

Single file or directory: Operate on the current repo only.
Multiple repos (e.g., “server, clients, android”): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at <base-dir>/<repo>. If a clone is not found, inform the user and skip that repo.
No specific target: Fix all findings in .github/workflows/ of the current directory.

If the user has not run the workflow-audit skill first, run the linter now to identify findings before proceeding.

Step 3: For Each Repo in Scope

Repeat Steps 4–7 for each repo. Announce which repo is being worked on.

Step 4: Create a Fix Branch

Only create the fix branch if there are findings to fix:

git checkout -b fix/workflow-linter-findings

Step 5: Apply Fixes

Consult the bitwarden-workflow-linter-rules skill for the correct fix for each rule.

For mechanical findings: Apply all fixes without prompting.

Exception — step_pinned: Before applying each hash pin, follow the step_pinned fix procedure from the bitwarden-workflow-linter-rules skill (resolve SHA via gh api, show verification link, wait for user confirmation).

For judgment findings: For each one, pause and present the finding clearly. Ask the user which option they want (per the bitwarden-workflow-linter-rules skill), then apply their choice.

Step 6: Verify Fixes

Re-run the linter to confirm all findings are resolved:

bwwl lint -f .github/workflows/

If errors remain, analyze and fix them. Repeat until clean.

Step 7: Review and Create PR

After all fixes are applied:

Show a git diff of all changes made.
Ask the user to confirm they want to proceed with a PR.
Do not run the staging, commit, or push commands yourself. Present the block below for the user to run manually as a suggestion:

git add .github/workflows/
git commit -m "Fix workflow linter findings"
git push -u origin fix/workflow-linter-findings

Once the user confirms the push, create the draft PR:

gh pr create \
  --title "Fix workflow linter findings" \
  --body "Automated fixes for findings from the Bitwarden workflow linter (bwwl)." \
  --draft

Step 8: Summary

After processing all repos, output a summary table:

Repo	Findings Fixed	PRs Created	Skipped / Notes
…	…	…	…

About this skill

Trigger

Apply fixes for workflow linter findings identified by the workflow-audit skill. Applies mechanical fixes automatically, pauses for judgment calls, verifies with a re-lint, and creates draft PRs. Run the workflow-audit skill first to identify findings before using this skill. <example> User: Go ahead and fix the linter findings from the audit Action: Trigger workflow-fix to apply fixes and create PRs </example> <example> User: Fix the workflow linter issues in server and clients Action: Trigger workflow-fix for those repos </example>

The verbatim description from this skill’s front matter — the string an agent matches on to decide whether to load it.

Allowed tools: ReadEditGlobGrepSkillBash(bwwl:*)Bash(gh api --method GET *)Bash(git checkout:*)Bash(git diff:*)Bash(git status:*)Bash(gh pr create:*)
Source: plugins/bitwarden-devops-engineer/skills/workflow-fix/SKILL.md

Colophon for this issue

Colophon

How this issue was made

Source

github.com/bitwarden/ai-plugins, branch main, last pushed 21 September 2026.

Licence

Other — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

65 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 13 distinct layouts observed: plugins/bitwarden-atlassian-tools/skills/*/SKILL.md, plugins/bitwarden-code-review/skills/*/SKILL.md, plugins/bitwarden-delivery-tools/skills/*/SKILL.md, plugins/bitwarden-design-tools/skills/*/SKILL.md, plugins/bitwarden-designer/skills/*/SKILL.md, plugins/bitwarden-devops-engineer/skills/*/SKILL.md, plugins/bitwarden-product-analyst/skills/*/SKILL.md, plugins/bitwarden-security-engineer/skills/*/SKILL.md, plugins/bitwarden-shepherd/skills/*/SKILL.md, plugins/bitwarden-tech-lead/skills/*/SKILL.md, plugins/bitwarden-testing-tools/skills/*/SKILL.md, plugins/claude-config-validator/skills/*/SKILL.md, plugins/claude-retrospective/skills/*/SKILL.md.

Issue colours

Resolved from a deterministic hash of the owner name. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

None needed in this skill: the outline was already valid.

Spec compliance

10 editorial notes across 5 of 65 skills. They are printed in the margin of each skill rather than as errors here.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .claude-plugin/marketplace.json by Bitwarden, declaring 16 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /bitwarden/ai-plugins.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Rules

No mutating API calls without confirmation. gh api GET requests are allowed freely. Any call using -X POST, -X PUT, -X PATCH, or -X DELETE must be shown to the user and approved before execution.

Never force-push, delete branches, or delete repositories.

Only modify files under .github/. Do not touch application code, scripts, or configuration outside of workflow files.

Show a diff and get confirmation before handing off for commit.

All PRs must be created as drafts.

Flag uncertainty. If a finding is ambiguous or a fix could break a workflow, stop and ask rather than guessing.

Step 2: Determine Scope

Parse the user’s request to determine what to fix:

Single file or directory: Operate on the current repo only.

Multiple repos (e.g., “server, clients, android”): Operate on each repo sequentially. Ask the user for the base directory where their repos are cloned. For each repo, look for its local clone at <base-dir>/<repo>. If a clone is not found, inform the user and skip that repo.

No specific target: Fix all findings in .github/workflows/ of the current directory.

If the user has not run the workflow-audit skill first, run the linter now to identify findings before proceeding.

Step 5: Apply Fixes

Consult the bitwarden-workflow-linter-rules skill for the correct fix for each rule.

For mechanical findings: Apply all fixes without prompting.

For judgment findings: For each one, pause and present the finding clearly. Ask the user which option they want (per the bitwarden-workflow-linter-rules skill), then apply their choice.

Step 7: Review and Create PR

After all fixes are applied:

Show a git diff of all changes made.

Ask the user to confirm they want to proceed with a PR.

Do not run the staging, commit, or push commands yourself. Present the block below for the user to run manually as a suggestion:

git add .github/workflows/
git commit -m "Fix workflow linter findings"
git push -u origin fix/workflow-linter-findings

Once the user confirms the push, create the draft PR:

gh pr create \
  --title "Fix workflow linter findings" \
  --body "Automated fixes for findings from the Bitwarden workflow linter (bwwl)." \
  --draft

Repo

Findings Fixed

PRs Created

Skipped / Notes

…